Hygiene: README claims match reality, cloud-first install block, drop dead package and empty deploy script

[davidcrowe]

Summary

Hygiene pass: README claims checked against reality, install block leads with
the cloud path per the current default, one dead package removed, one empty
script removed. No behavior change to any published package.

Changes (one per commit)

• README: install block now embeds the acp-install demo GIF and adds a
  one-line Add --local to run on-device with no account. note under the
  cloud curl command (the command itself already led with cloud, no
  --local, so that part needed no change).
• README: pip install hermes-acp → pip install acp-hermes — the
  hermes-acp-plugin's pyproject.toml declares name = "acp-hermes";
  hermes-acp is only a compatibility console-script alias, not the
  distribution name.
• Removed packages/explicabl-core (@gatewaystack/observability-core,
  v0.0.1): both source files were 0 bytes, no description/license, name
  doesn't match its directory, and nothing imports it — confirmed via
  grep -r "observability-core\|explicabl-core" --include=package.json --include=*.ts . outside its own tsconfig. Only referenced through
  tsconfig project references/paths (root tsconfig.json,
  tsconfig.base.json, apps/gateway-server/tsconfig.json), all removed.
  package-lock.json regenerated via npm install.
• Removed apps/gateway-server/deploy.sh (0 bytes, no README reference).
• README: test count corrected from "185 tests across 17 test files" to
  the real 228 tests across 24 test files — counted with
  find packages tests -name "*.test.ts" | wc -l (24) and confirmed with
  npm test (228 passed, 24 files).
• examples/quickstart/README.md: sample output's detected: line updated
  from email, ssn to the real email, ssn, icd_9 — ran
  npm install --ignore-scripts && npm start in examples/quickstart and
  pasted the actual output.

Test output (after all changes, from repo root)

npm run build   → clean, no output (tsc -b all packages/apps)
npm test        → Test Files  24 passed (24)
                   Tests       228 passed (228)
                   Duration    541ms

Ghost-PR audit (for the coordinator — nothing closed by this PR)

Checked every non-dependabot open PR (#35–#49) by fetching each PR's head ref
and diffing file-by-file against current origin/main. Evidence: commit
c48a30d ("Star-push OSS cleanup — one clean merge (bundles
#44/#38/#45/#48/#49/#35/#37/#47) (#50)") explicitly lists 8 of them; #46's
content was independently confirmed byte-identical to main's current
policy.ts/scopes.ts (it duplicates #41, which reached main via commit
176316d, PR #51). #36 is the one real gap — its fix is not on main.

PR	Title	Opened	Already in main?	Evidence
#49	Add a zero-config quickstart example: governance in 30 seconds	2026-07-23	Yes	All PR files byte-identical to main; bundled in c48a30d (#50)
#48	Correct proxyabl SSRF marketing to match what actually runs (#43)	2026-07-23	Yes	All PR files byte-identical to main; bundled in c48a30d (#50)
#47	Package hygiene: per-package LICENSE, engines, tsbuildinfo out of dist, dep fixes (#42)	2026-07-23	Yes	All PR files byte-identical to main; bundled in c48a30d (#50)
#46	Enforcement-core hardening: fail-open & policy-widening fixes (#41)	2026-07-23	Yes	policy.ts/scopes.ts byte-identical to main; duplicate of #41, merged as #51 (commit 176316d)
#45	transformabl-core 0.4.1: redactPii overlap fix (H4) + scan-truncation flag (M2)	2026-07-23	Yes	All PR files byte-identical to main; bundled in c48a30d (#50)
#44	Remove hardcoded conformance badge, report, and CI artifact (#39)	2026-07-23	Yes	All PR files byte-identical to main; bundled in c48a30d (#50)
#38	docs(identifiabl): fix Quick Start to use the real export name	2026-07-23	Yes	All PR files byte-identical to main; bundled in c48a30d (#50)
#37	fix(explicabl): drop undeclared node-fetch import; use global fetch	2026-07-23	Yes	All PR files byte-identical to main; bundled in c48a30d (#50)
#36	fix(proxyabl): close trailing-slash scope-check bypass in middleware	2026-07-23	No	middleware.ts diff is non-empty vs main (the .split("/").filter(Boolean).pop() fix is missing); its test file middleware.scope.test.ts doesn't exist on main at all
#35	fix(proxyabl): declare jose as a runtime dependency	2026-07-23	Yes	All PR files byte-identical to main; bundled in c48a30d (#50)

Dependabot (list only, per instructions):

PR	Bump
#59	postcss 8.5.6 → 8.5.26
#57	ip-address and express-rate-limit (multi-bump)
#54	shell-quote 1.8.3 → 1.10.0 (dev)
#52	body-parser 1.20.4 → 1.20.6
#29	form-data 4.0.5 → 4.0.6
#28	vite 6.4.2 → 6.4.3 (dev)
#26	vitest 4.0.15 → 4.1.0 (dev)

Recommendation: close #35, #37, #38, #44–#49 as already-in-main (8 PRs); keep #36 open — it's a real, unmerged bypass fix.